dotCooCoo b7709a3c1f MCP: SVG export by a confined caller refuses script links outside its read roots ...

An SVG or SVGZ writes each linked JavaScript file of SVG Interactivity
into a <script xlink:href> element as stored, so a caller with
automation read roots could read a path outside them from the exported
text. With read roots in force, an SVG or SVGZ of a document that links
such a file is now refused with "a linked JavaScript file is outside the
read roots", an error that names no file or folder. No file or folder is
written, and the document keeps the link.

- The check uses the rule document.json already applies to
  svg_scripts: a relative path is taken from the document's folder, a
  file: URL is a file, and another URL is not checked.
- It covers document.serialize, document.export, document.exportSelection,
  document.exportForScreens and assets.export (before the folder is made
  or any row is written), the SVG and SVGZ saves (also a save without a
  path of a document saved as SVG), file.exportAs and the SVG Options
  dialog's Show Code.
- Callers without roots, and the person at the keyboard, export the
  links as stored.

Docs: docs/mcp.md, docs/target-app-parity.md.

2026-11-13 11:46:18 -08:00

..

examples

…

src

MCP: SVG export by a confined caller refuses script links outside its read roots

2026-11-13 11:46:18 -08:00

tests

Merge pull request #7207 from dotCooCoo/fix/engine-test-temp-folders

2026-11-14 01:54:55 +07:00

Cargo.toml

…